PT-2026-86187 · Linux · Linux
CVE-2026-80896
·
Publicado
2026-09-04
·
Atualizado
2026-09-04
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
mshv: Fix race in mshv irqfd deassign
mshv irqfd deactivate() and the hlist traversal of pt irqfds list
require pt->pt irqfds lock to be held, but mshv irqfd deassign()
omits it. This races with the EPOLLHUP path in mshv irqfd wakeup(),
which does take the lock before calling mshv irqfd deactivate().
Additionally, mshv irqfd deactivate() uses hlist del() which poisons
the node pointers rather than resetting them. Since
mshv irqfd is active() relies on hlist unhashed() (checks pprev ==
NULL), a poisoned node still appears active. If a concurrent path calls
mshv irqfd deactivate() again on the same irqfd, the guard fails to
prevent a double hlist del() on poisoned pointers.
Fix both issues:
- Add the missing spin lock irq/spin unlock irq around the list traversal in mshv irqfd deassign(), matching mshv irqfd release().
- Use hlist del init() instead of hlist del() so the node is properly marked as unhashed after removal, making the is active guard reliable.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux